What consent and disclosure does a chatbot need under DPDP? A chatbot that collects personal data in conversation needs, under the DPDP Act 2023, a clear disclosure that the user is talking to an automated system (not a human), a plain-language notice of what data the conversation captures and why, purpose-specific consent before that data is used beyond simply answering the query, and a defined retention and deletion policy for transcripts. Chatbots create specific risks: users volunteer personal and even sensitive information freely in chat, conversations are logged and often used to train the bot, and many bots route messages through third-party AI providers. A chatbot consent framework kit gives you the bot-identity disclosure, the conversation-start notice, the consent capture points and the transcript-retention policy to make a chatbot DPDP-compliant. This kit produces those elements tailored to your bot's channel and purpose.
Bot-identity disclosure, conversation-start notice, purpose-specific consent and transcript-retention policy for chatbots under DPDP — tailored to your bot's channel, purpose and data capture.
The kit begins with the single most important, and most often skipped, disclosure: telling the user clearly that they are conversing with an automated system rather than a human. This is a fairness and transparency issue at the heart of the DPDP Act's principles — a person volunteers information very differently to what they believe is a human agent versus a bot, and letting them assume a human when it is a machine is both a trust breach and a compliance risk. The disclosure is placed at the start of the conversation, in the bot's opening message, in language a user actually reads: a short, unambiguous statement of the bot's automated nature and its purpose.
The section also covers the hand-off case that trips up many deployments: bots that escalate to a human agent mid-conversation, or that a human occasionally takes over. The user should be told when the identity on the other end changes, because their expectations about privacy and how their words will be used shift with it. Getting bot-identity disclosure right at the top of every conversation is a small change that removes a disproportionate amount of legal and reputational risk.
Immediately after identity disclosure comes the data notice: a concise, plain-language statement of what the conversation collects, why, and what happens to it. It tells the user that messages they send are processed to answer their query and may be logged, names the broad categories of data captured (contact details, account information, and crucially the free-text content of their messages), and points to where they can find the full privacy policy and how to raise a grievance. The DPDP Act requires notice that is clear and specific about how personal data is used, and the conversation start is the natural, honest place to give it for a chat interface.
This notice matters most because of a behaviour unique to chat: users volunteer far more than they are asked. People type health symptoms, financial details, complaints naming other individuals, and personal circumstances into a support or assistant bot without being prompted for any of it. The conversation-start notice sets an honest expectation — that whatever they type is being processed and logged — and the kit pairs it with guidance to minimise capture (not storing free text longer than needed, redacting obvious sensitive data) so the bot does not accumulate a liability of over-shared personal data it never needed.
Conversation data captured, selected for your kit:
Chatbots have become a default interface for support, sales and assistance, and every one of them that collects personal data in conversation is subject to the DPDP Act 2023. The compliance picture for a chatbot is shaped by three facts about how people use them. First, users do not know, or forget, that they are talking to a machine, so a clear bot-identity disclosure at the start is a fairness baseline. Second, users volunteer far more personal information in a free-flowing chat than any form would ever ask for — health details, financial worries, other people's information — which makes the conversation-start data notice and data minimisation genuinely important. Third, many chatbots are powered by third-party LLMs and log every message, so consent, retention and vendor disclosure all come into play.
None of this requires a separate chatbot law — it requires applying DPDP's existing notice, consent, purpose-limitation and security principles to the specifics of a conversational interface. A chatbot consent framework does exactly that: identity disclosure, a start-of-conversation notice, purpose-specific consent for anything beyond answering the query, and a transcript-retention policy that stops the bot from silently accumulating a liability of over-shared personal data.
Two chatbot data flows deserve particular care under DPDP. The first is transcript handling: conversation logs are personal data, often rich and sensitive, and keeping them indefinitely or using them to train the bot without disclosure is a real exposure. A sensible policy minimises what free text is retained, sets a clear deletion timeline, and treats any use of conversations to improve the bot as a distinct purpose that is disclosed and, where appropriate, opt-out. The second is third-party processing: if messages are routed to an external LLM, that provider is a sub-processor whose handling of the content must be disclosed to users and bound by a vendor data processing agreement.
With DPDP enforcement expected around May 2027, any business running a customer-facing chatbot should get these disclosures and policies in place now — they are quick to implement and remove a common, avoidable risk. Niti Bharat runs fixed-price DPDP compliance engagements (₹75,000–₹3.2 lakh) that cover chatbot disclosure, transcript governance and the vendor agreements behind the AI providers powering conversational products.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
